4

I have five iMacs with OSX 10.8.5. Two of the iMacs are binding to Windows domain server (2012) successfully. But I can’t bind remaining three iMac machines, and it is showing authentication error 5202, 5200 error and some times it shows 2000 error. It is able to access windows share using domain user ID.

There is no issue when binding any Windows OS version (XP/7/8) to the domain.

I have checked the following things:

  • Verify the time of iMacs with Windows server
  • DNS resolution

Please suggest a solution.

Improve this question

2 Answers 2

Reset to default
1

Are you using 10.0.8 or 10.8? Hopefully the latter. Here's where I'd start

  1. Try running dsconfigad -show and make sure that the computer account matches what you see in ADU&C on your Windows Server. If your Mac had spaces in the name (e.g., My Cool Mac), your AD server might not be interpreting it correctly. Also make sure your advanced Administrative options are not in conflict
  2. I've experienced issues on Macs when the 3 different computer names are out of sync. Run scutil and make sure that HostName, ComputerName and LocalHostName are all in sync. You can use the --set option to modify them.
  3. Make sure that the accounts joining to the domain have enough rights to join to the OU you've specified and that the user's AD group has access to login to the mac from the network. You can do this from the Directory Utility.

HTH

Improve this answer
2
  • I can't add imac machines to windows domain.The dsconfigad -show,for Mac that was already added to domain.
    – user308211
    Mar 19, 2014 at 7:22
  • In my experiences, joining OSX to AD is not as forgiving as joining a Windows box (go figure). Try using the -force option of dsconfigad to remove it from the domain. Then try adding it back to AD without the -force option. If that fails, try again WITH force. One of these should work. GL.
    – SaxDaddy
    Mar 19, 2014 at 18:20
0

We had this error:

dsconfigad: Authentication server encountered an error while attempting the requested operation. (5202)

and in the /var/log/opendirectoryd.log

...
2016-03-10 11:08:30.210484 GMT - AID: 0x0000000000000000 - 1280.6968, Node: /Active Directory, Module: ActiveDirectory - krb5.dylib - krb5_get_init_creds: KRB-ERROR -1765328378/Client ([email protected]) unknown
2016-03-10 11:08:30.210505 GMT - AID: 0x0000000000000000 - 1280.6968, Node: /Active Directory, Module: ActiveDirectory - password verify for [email protected] failed with error -1765328378 - 'Client ([email protected]) unknown'
2016-03-10 11:08:30.210574 GMT - AID: 0x0000000000000000 - 1280.6968, Node: /Active Directory, Module: ActiveDirectory - ODNodeCustomCall failed with error 'Credential server error' (5202)
...

joining a machine running 10.11.x that had been unbound from the domain. Nothing would allow it to bind - using either OpenDirectory or dsconfigad

The fix was deleting the following:

/var/db/dslocal/nodes/Default/config/
/etc/krb5.keytab
/Library/Preferences/OpenDirectory

This issue affected two machines which have now been able to successfully bind.

Improve this answer
1
  • 2
    beware: we followed these steps and the machine will no longer boot.
    – wilson0x4d
    Apr 21, 2017 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .